The tracking is done in a “boneheaded” way, said privacy scholar Jonathan Mayer: the code is publicly broadcast, meaning it’s not just the wireless carrier who can use the code for tracking purposes but anyone who intercepts the information sent, including the website the person is visiting, any third parties on that site, or perhaps an all-seeing entity like the NSA.